Data Governance

Large organizations collect vast amounts of information: customer addresses, orders, measurements from machines, medical records. Data governance is the set of rules that organizes how this information is handled. It answers four questions: Who owns which data? Who is allowed to view or change it? How can one tell if it is correct? And when must it be deleted? This is not primarily about technology, but above all about responsibilities and binding agreements between people. You can think of data governance like the house rules of a large library: it says who may borrow books, who shelves them, and what happens to damaged copies.

What happens when no one sets the rules

Without clear rules, every department ends up building its own data collections. Sales keeps one customer list, marketing a second, support a third. All three contradict each other at some point. Then, when someone asks how many customers the company has, there are three different answers. Exactly these kinds of contradictions cost time and lead to wrong decisions.

On top of that comes legal pressure. The European General Data Protection Regulation, or GDPR, requires companies to be able to provide information about stored personal data at any time. Anyone who doesn’t know where which data is located cannot fulfill this obligation. Fines can reach up to four percent of global annual revenue. For a large corporation, that quickly adds up to billions.

For artificial intelligence, data governance has become additionally important. AI systems learn from data and inherit its flaws. If the training data is incomplete, outdated, or biased, the finished system becomes unreliable. In the industry there’s a saying for this: garbage in, garbage out.

Roles, catalogs, and access rights

The first building block is roles. For every important data set, a person is named who is responsible for it. This role is often called a data owner or data steward. They decide on access rights and resolve disputes when figures contradict each other. Without named individuals, every rule remains ineffective.

The second building block is a data catalog. This is a kind of table of contents for all data holdings within the company. It records which information is stored where, where it comes from, and what individual fields mean. Also important is so-called lineage tracking: it shows from which sources a figure was calculated. This makes it possible to trace an error back to its origin.

The third building block is technical controls. Access rights are tied to roles, not to individual people. Particularly sensitive fields, such as dates of birth, are anonymized when developers work with test data. Automatic checks raise an alert when a value is impossible, such as an age of 200 years. And retention periods ensure that data does not sit around forever.

From the school network to the corporate balance sheet

In business news, the term mostly comes up in connection with mishaps. When a bank reports incorrect risk figures to the regulator, or a hospital loses patient data, the diagnosis is almost always: poor data governance. It’s also an issue in company acquisitions, since two separately grown data landscapes must be merged.

For AI products, it is increasingly becoming a selling point. Providers promise that company data entered by users will not be used to train their models. The European AI Act also requires documentation of training data for high-risk applications. Anyone who cannot provide this proof may not offer their system in the EU.

The principle also shows up on a small scale. A school regulates who is allowed to enter grades and who may only read them. A common misconception is to equate data governance with data protection. Data protection concerns only personal information. Data governance also covers machine data, prices, or inventory levels, where it’s purely about order and reliability.